The GreyNoise MCP Server provides MCP-compatible clients with access to GreyNoise threat intelligence across the following capability areas:
IP Analysis
Lookup IP Context: Full details for a single IP (classification, tags, geo, scan/HTTP/TLS/SSH data, etc.)
Quick Check IP: Fast, lightweight classification for a single IP
Multi-IP Check: Bulk check up to 10,000 IPs at once
GNQL (GreyNoise Query Language) Search
GNQL Query: Full search with raw scan data and scroll pagination
GNQL Metadata Query: Lighter metadata-only search with optional CSV output
GNQL Stats: Aggregate statistics (top orgs, countries, tags, ASNs, classifications)
Recall / Timeseries Analysis
GNQL Timeseries: Hourly IP-activity records over a time range
GNQL Timeseries Stats: Unique-IP counts per hour/day over a time range
Tags
List, search, and get details for GreyNoise tags; view tag activity timeseries; analyze and aggregate tag activity summaries
Vulnerability Intelligence
Get CVE Details: CVSS/EPSS scores, KEV status, exploitation stats, and observed activity
Get Trending Vulnerabilities: Currently trending and anomalous vulnerability tags
Sensor Sessions
Search and filter sessions, discover field schema, aggregate counts, build connection graphs, view timeseries, get unique values, retrieve individual session metadata, and download PCAPs
Business Service Intelligence (BSI) (requires BSI license)
Single and bulk IPv4 provider lookups; statistics grouped by trust level, company, and category
Callback / C2 Intelligence (requires entitlement)
Look up individual callback/C2 IPs, list/filter/export them, and get aggregate overview statistics
Blocklists (requires entitlement)
Create, list, get, update, and delete dynamic GNQL-based blocklists; retrieve current IPs in a blocklist
Alerts (requires entitlement)
Create, list, get, update, enable, disable, and delete scheduled GNQL alerts; test webhook delivery
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@greynoise-mcp-server analyze IP 71.6.135.131"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol server for the GreyNoise API. It gives MCP-compatible clients (Claude Desktop, Claude Code, Cursor, etc.) access to GreyNoise threat intelligence — IP context, GNQL search, Recall timeseries, tags, CVEs, sensor sessions, BSI, callback/C2 data — plus operational tools to act on findings (blocklists and alerts).
Requires a GreyNoise API key. Your plan's entitlements determine which capabilities are available; the server exposes every tool and returns a clear "not entitled" message for any capability your plan doesn't include, so the rest keep working.
Download greynoise-mcp-server.mcpb from the releases page and double-click to install. It prompts for your API key.
{
"mcpServers": {
"greynoise": {
"command": "npx",
"args": ["@greynoise/greynoise-mcp-server"],
"env": { "GREYNOISE_API_KEY": "your-greynoise-api-key" }
}
}
}{
"mcpServers": {
"greynoise": {
"command": "node",
"args": ["/absolute/path/to/greynoise-mcp-server/build/index.js"],
"env": { "GREYNOISE_API_KEY": "your-greynoise-api-key" }
}
}
}Related MCP server: OSINT MCP Server
Variable | Required | Default | Purpose |
| yes (stdio) | — | GreyNoise API key. For HTTP transport the key is taken per-request from the |
| no |
| Override the API base (e.g. staging). |
| no |
| HTTP transport listen port. |
| no |
| Allowed Host header values (DNS-rebinding protection) for HTTP transport. |
npx @greynoise/greynoise-mcp-server # stdio (default)
npx @greynoise/greynoise-mcp-server --transport http # streamable HTTP on $PORTstdio is the default and what desktop/CLI clients use. HTTP transport authenticates each request via a Bearer token, builds an isolated server per request, and enforces DNS-rebinding protection. Express is loaded lazily for HTTP; install it if you use that transport (npm install express).
Every tool returns both human-readable text and machine-readable structuredContent (validated against a published outputSchema), and carries MCP annotations so clients can apply safety policy — read-only tools run freely; write tools are marked, and destructive ones (delete-*) request confirmation.
Tool | Description |
| Full context for one IP: classification, tags, ISI (scan/HTTP/TLS/SSH/TCP raw data), BSI, geo, network metadata. |
| Fast, lightweight classification + business-service check for one IP. |
| Check up to 10,000 IPs at once, with a summary breakdown. |
Tool | Description |
| Full GNQL search including raw scan data; scroll pagination. |
| Lighter GNQL search (metadata only). Supports |
| Aggregate statistics for a GNQL query (top orgs, countries, tags, ASNs, classifications, …). |
Tool | Description |
| Hourly IP-activity records for a query over a time range. |
| Unique-IP counts per hour/day over a time range. |
Tool | Description |
| Complete tag list (cached 1h). |
| Search tags by query / category / intention / CVE. |
| Full record for one tag by id or slug. |
| Time-series activity for a tag or CVE. |
| Filter tags and aggregate their activity into a summary. |
Tool | Description |
| GreyNoise intel for one CVE: CVSS/EPSS, KEV status, exploitation + observed activity. |
| Currently trending and anomalous vulnerability tags. |
Tool | Description |
| Query/filter sensor sessions over a time range (Lucene syntax). |
| Discover the queryable session field schema. |
| Session counts grouped by one or more fields (nested drill-down). |
| Connection graph (nodes + links) between source/destination fields. |
| Session volume over time, optionally grouped by a field. |
| Distinct values of a field, optionally with counts. |
| Full metadata for one session by ID. |
| Download one session's PCAP to a temp file. |
| Export a PCAP across multiple sessions matching a query. |
| Download one session as PCAP or raw payload. |
Tool | Description |
| Provider matches for one IPv4. |
| Provider matches for up to 1,000 IPv4 addresses. |
| IP/CIDR counts grouped by trust level / company / category. |
Tool | Description |
| One callback/C2 IP: attack stage, RIOT status, enrichment, downloaded files. |
| Paginated callback IPs filtered by stage, dates, file attributes, scanners. |
| Export matching callback IPs as a plain list. |
| Aggregate statistics for matching callback IPs. |
Tool | Notes |
| Create a dynamic blocklist from a GNQL query. |
| Read. |
| Update query/name/limit/enabled. |
| Destructive — clients confirm. |
Tool | Notes |
| Scheduled GNQL alert with email/webhook recipients. |
| Read. |
| Update query/schedule/recipients/name/enabled. |
| Resume / pause. |
| Destructive — clients confirm. |
| Send a test payload to a webhook URL. |
Read-only URIs clients can fetch or reference directly:
Resource | Description |
| IP context (JSON). |
| CVE exploitation details (JSON). |
| Tag metadata by slug (with slug autocompletion). |
| A single GreyNoise research article. |
| List of published research articles. |
| Article categories. |
Guided analysis workflows:
Prompt | Arguments ( |
|
|
|
|
|
|
|
|
|
|
|
|
npm install
npm run build # bundle with tsup -> build/index.js
npm run dev # watch + rebuild + run
npm test # jest
npm run typecheck # tsc --noEmit
npm run pack:mcpb # build the .mcpb bundleThe zod schemas in src/greynoise/schemas/ are the single source of truth for API response shapes (they validate responses at runtime and drive each tool's outputSchema). A vendored copy of the API's OpenAPI spec lives in spec/oas-production.yaml; run the /update-api reconciliation to check tools/schemas against it.
Releases are automated via GitHub Actions, with a manual approval gate. Two workflows:
.github/workflows/ci.yml — runs on every PR/push: typecheck, tests, build, npm audit, and a .mcpb build. No credentials required.
.github/workflows/release.yml — runs on a v* tag: publishes to npm via staged publishing and drafts a GitHub Release with the .mcpb. Nothing goes public without a human.
npm Trusted Publisher (OIDC) — configured on npmjs.com for this repo + release.yml with npm stage publish (stage-only) permission. No NPM_TOKEN is stored; auth is tokenless via GitHub OIDC.
The workflow has id-token: write and contents: write, and upgrades npm to satisfy staged publishing (npm ≥ 11.15.0, Node ≥ 22.14).
Push a version tag — that's the whole release. The git tag is the single source of truth: the workflow stamps it into package.json + manifest.json (and the User-Agent) at build time, so there's nothing to bump or keep in sync by hand.
git tag v0.5.1 && git push origin v0.5.1The tag triggers release.yml, which stages that version to npm and creates a draft GitHub Release. Neither is public yet.
Staged publishes require a maintainer with 2FA — they can't be approved from CI (by design):
npm stage list @greynoise/greynoise-mcp-server # find the stage-id
npm stage view <stage-id> # (optional) inspect
npm stage approve <stage-id> # 2FA -> version goes live(Or approve from the package page on npmjs.com.) Then publish the draft GitHub Release from the Releases tab to make the .mcpb public.
See NEWS.md.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
GreyNoise Community MCP — internet scanner classification (free tier with key)
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Official Microsoft MCP Server to query Microsoft Entra data using natural language
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/GreyNoise-Intelligence/greynoise-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
